Penetration Testing: Wireless SSID discovery

[Andrew Bagrin <abagrin () gmail com>]

I'm doing a wireless pen-test and am able to use aircrack  to crack
the wep key, however, when I use Kismet, Cain, airdump etc.. I can't
get the SSID of a the access point if the SSID broadcast has been
disabled.  Does anyone know how to do this, or is there any tools that
will let you get the SSID even if its not being broadcasted.

Thanks,

Andrew